CVE-2026-3723 identifies a SQL Injection vulnerability in the Simple Flight Ticket Booking System version 1.0 developed by code-projects. The vulnerability resides in the /Admindelete.php file, where the flightno parameter is improperly sanitized, allowing attackers to inject malicious SQL code. This injection flaw enables remote attackers to manipulate backend database queries without authentication or user interaction, potentially leading to unauthorized data disclosure, data modification, or deletion. The vulnerability is exploitable over the network, increasing its risk profile. The CVSS 4.0 vector indicates no privileges or user interaction are required, with low complexity and partial impact on confidentiality, integrity, and availability. Although no active exploitation has been reported, the public availability of an exploit increases the likelihood of attacks. The lack of a vendor patch at the time of disclosure necessitates immediate mitigation efforts. This vulnerability is critical for organizations using this booking system, especially those handling sensitive flight and customer data, as exploitation could compromise operational integrity and customer trust.

The SQL Injection vulnerability could allow attackers to access or manipulate sensitive flight booking data, including passenger information and flight schedules. This can lead to data breaches, unauthorized changes to bookings, or disruption of booking operations. The integrity of the booking system could be compromised, resulting in financial losses and reputational damage. Since the vulnerability requires no authentication and can be exploited remotely, the attack surface is broad, potentially affecting any organization using the affected software version globally. The availability of a public exploit increases the risk of automated attacks and widespread exploitation. In critical infrastructure or high-volume travel service providers, such an attack could disrupt services and impact customer safety and satisfaction. The medium severity rating reflects the balance between ease of exploitation and partial impact on system security properties.

Organizations should immediately review and restrict access to the /Admindelete.php script, ideally limiting it to trusted administrative networks. Implement strict input validation and sanitization on the flightno parameter to prevent injection of malicious SQL code. Transition the codebase to use parameterized queries or prepared statements to eliminate SQL injection vectors. Monitor web application logs for suspicious activity targeting the flightno parameter or /Admindelete.php endpoint. If possible, apply any vendor patches or updates once released. Employ web application firewalls (WAFs) with rules designed to detect and block SQL injection attempts targeting this parameter. Conduct thorough security testing of the booking system to identify and remediate other potential injection points. Educate development teams on secure coding practices to prevent similar vulnerabilities in future releases.